本文介紹系統內建員工和自訂數字員工的許可權配置方法。
STAROps 許可權模型和授權對象說明，請先閱讀《許可權配置》。本文不重複展開許可權原理，只提供按情境可複製的權限原則。
配置數字員工前，請先判斷使用的是系統內建員工還是自訂數字員工。
使用者操作許可權（RAM 使用者權限）
使用者操作許可權配置給 RAM 使用者，決定這個使用者能不能查看、建立、管理或使用數字員工。無論使用系統內建員工還是自訂數字員工，都需要先配置這一層。
使用系統內建員工時，只需要給 RAM 使用者配置 STAROps 使用許可權和必要的資料讀取許可權。系統內建員工不綁定客戶側 RAM Role，因此不需要配置 ram:PassRole。
使用自訂數字員工時，RAM 使用者除了需要數字員工操作許可權，還需要具備目標 RAM Role 的 ram:PassRole。否則使用者可以看到或建立數字員工，但不能把該角色傳遞給 STAROps 使用。
使用系統內建員工
以下策略適用於使用系統內建員工進行對話、查看會話、查看產物和讀取診斷資料的情境。系統內建員工不支援 MCP、AliyunCLI 等擴充配置；如果需要這些能力，請使用自訂數字員工。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"starops:GetDigitalEmployee",
"starops:ListDigitalEmployees"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateArtifactUploadToken",
"starops:GetArtifactDownloadUrl",
"starops:CreateChat",
"starops:CreateThread",
"starops:GetThread",
"starops:GetThreadData",
"starops:ListThreads"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*",
"acs:starops:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetDigitalEmployeeSkill",
"starops:ListDigitalEmployeeSkills",
"starops:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetMission",
"starops:ListMissions",
"starops:ListTasks"
],
"Resource": [
"acs:starops:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetMcpService",
"starops:ListMcpServices",
"starops:FetchRemoteMcpTools"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetArtifact",
"starops:ListArtifacts"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetCreditQuota"
],
"Resource": [
"acs:starops:*:*:quota/credit"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetDigitalEmployee",
"cms:ListDigitalEmployees"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateChat",
"cms:CreateThread",
"cms:GetThread",
"cms:GetThreadData",
"cms:ListThreads"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*",
"acs:cms:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetDigitalEmployeeSkill",
"cms:ListDigitalEmployeeSkills",
"cms:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetMission",
"cms:ListMissions",
"cms:ListTasks"
],
"Resource": [
"acs:cms:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetMcpService",
"cms:ListMcpServices",
"cms:FetchRemoteMcpTools"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetArtifact",
"cms:ListArtifacts"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:ListWorkspaces",
"cms:GetWorkspace",
"cms:GetEntityStore",
"cms:GetEntityStoreData"
],
"Resource": [
"acs:cms:*:*:workspace/*",
"acs:cms:*:*:entitystore/*",
"acs:cms:*:*:entitystoredata/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetCloudResourceData"
],
"Resource": [
"acs:cms:*:*:cloudresource"
]
},
{
"Action": [
"log:Get*",
"log:List*",
"log:Query*"
],
"Resource": "acs:log:*:*:*",
"Effect": "Allow"
}
]
}建立和管理自訂數字員工
以下策略允許 RAM 使用者建立、修改、刪除、查看數字員工，管理 Skill/MCP、會話、長期任務和產物，並與數字員工對話。樣本中的 ram:PassRole 預設收斂到服務角色 AliyunServiceRoleForCloudMonitor；如果數字員工綁定自訂 RAM Role，請將 Resource 替換為對應 RoleArn。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"starops:CreateDigitalEmployee",
"starops:GetDigitalEmployee",
"starops:ListDigitalEmployees",
"starops:UpdateDigitalEmployee",
"starops:DeleteDigitalEmployee"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateArtifactUploadToken",
"starops:GetArtifactDownloadUrl",
"starops:CreateChat",
"starops:CreateThread",
"starops:GetThread",
"starops:GetThreadData",
"starops:ListThreads",
"starops:UpdateThread",
"starops:DeleteThread"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*",
"acs:starops:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateDigitalEmployeeSkill",
"starops:GetDigitalEmployeeSkill",
"starops:ListDigitalEmployeeSkills",
"starops:UpdateDigitalEmployeeSkill",
"starops:DeleteDigitalEmployeeSkill",
"starops:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateMission",
"starops:GetMission",
"starops:ListMissions",
"starops:ListTasks",
"starops:UpdateMission",
"starops:DeleteMission"
],
"Resource": [
"acs:starops:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateMcpService",
"starops:GetMcpService",
"starops:ListMcpServices",
"starops:UpdateMcpService",
"starops:DeleteMcpService",
"starops:FetchRemoteMcpTools"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetArtifact",
"starops:ListArtifacts"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetCreditQuota",
"starops:SetCreditQuota"
],
"Resource": [
"acs:starops:*:*:quota/credit"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateDigitalEmployee",
"cms:GetDigitalEmployee",
"cms:ListDigitalEmployees",
"cms:UpdateDigitalEmployee",
"cms:DeleteDigitalEmployee"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateChat",
"cms:CreateThread",
"cms:GetThread",
"cms:GetThreadData",
"cms:ListThreads",
"cms:UpdateThread",
"cms:DeleteThread"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*",
"acs:cms:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateDigitalEmployeeSkill",
"cms:GetDigitalEmployeeSkill",
"cms:ListDigitalEmployeeSkills",
"cms:UpdateDigitalEmployeeSkill",
"cms:DeleteDigitalEmployeeSkill",
"cms:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateMission",
"cms:GetMission",
"cms:ListMissions",
"cms:ListTasks",
"cms:UpdateMission",
"cms:DeleteMission"
],
"Resource": [
"acs:cms:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateMcpService",
"cms:GetMcpService",
"cms:ListMcpServices",
"cms:UpdateMcpService",
"cms:DeleteMcpService",
"cms:FetchRemoteMcpTools"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetArtifact",
"cms:ListArtifacts"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:ListWorkspaces",
"cms:GetWorkspace",
"cms:GetEntityStore",
"cms:GetEntityStoreData"
],
"Resource": [
"acs:cms:*:*:workspace/*",
"acs:cms:*:*:entitystore/*",
"acs:cms:*:*:entitystoredata/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetCloudResourceData"
],
"Resource": [
"acs:cms:*:*:cloudresource"
]
},
{
"Action": [
"log:Get*",
"log:List*",
"log:Query*"
],
"Resource": "acs:log:*:*:*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
"Condition": {
"StringEquals": {
"acs:Service": [
"operation-platform.aliyuncs.com",
"cloudmonitor.aliyuncs.com"
]
}
}
}
]
}僅對話許可權
以下策略適用於只允許使用者與自訂數字員工對話、查看自己的會話和產物的情境，不允許建立、修改或刪除數字員工和 Skill。由於對話時需要使用數字員工綁定的 RAM Role，因此需要同時授予 ram:PassRole。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"starops:GetDigitalEmployee",
"starops:ListDigitalEmployees"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateArtifactUploadToken",
"starops:GetArtifactDownloadUrl",
"starops:CreateChat",
"starops:CreateThread",
"starops:GetThread",
"starops:GetThreadData",
"starops:ListThreads",
"starops:UpdateThread"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*",
"acs:starops:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetDigitalEmployeeSkill",
"starops:ListDigitalEmployeeSkills",
"starops:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateMission",
"starops:GetMission",
"starops:ListMissions",
"starops:ListTasks",
"starops:UpdateMission"
],
"Resource": [
"acs:starops:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetMcpService",
"starops:ListMcpServices",
"starops:FetchRemoteMcpTools"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetArtifact",
"starops:ListArtifacts"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetCreditQuota"
],
"Resource": [
"acs:starops:*:*:quota/credit"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetDigitalEmployee",
"cms:ListDigitalEmployees"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateChat",
"cms:CreateThread",
"cms:GetThread",
"cms:GetThreadData",
"cms:ListThreads",
"cms:UpdateThread"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*",
"acs:cms:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetDigitalEmployeeSkill",
"cms:ListDigitalEmployeeSkills",
"cms:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateMission",
"cms:GetMission",
"cms:ListMissions",
"cms:ListTasks",
"cms:UpdateMission"
],
"Resource": [
"acs:cms:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetMcpService",
"cms:ListMcpServices",
"cms:FetchRemoteMcpTools"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetArtifact",
"cms:ListArtifacts"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:ListWorkspaces",
"cms:GetWorkspace",
"cms:GetEntityStore",
"cms:GetEntityStoreData"
],
"Resource": [
"acs:cms:*:*:workspace/*",
"acs:cms:*:*:entitystore/*",
"acs:cms:*:*:entitystoredata/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetCloudResourceData"
],
"Resource": [
"acs:cms:*:*:cloudresource"
]
},
{
"Action": [
"log:Get*",
"log:List*",
"log:Query*"
],
"Resource": "acs:log:*:*:*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
"Condition": {
"StringEquals": {
"acs:Service": [
"operation-platform.aliyuncs.com",
"cloudmonitor.aliyuncs.com"
]
}
}
}
]
}
唯讀許可權
以下策略適用於查看數字員工、會話、產物和相關診斷資料的情境，並允許使用者使用綁定服務角色的自訂數字員工發起會話。如果使用者只做審計查看，不需要發起會話或傳遞角色，可以刪除 CreateChat、CreateThread 和 ram:PassRole 相關語句。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"starops:GetDigitalEmployee",
"starops:ListDigitalEmployees"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:CreateArtifactUploadToken",
"starops:GetArtifactDownloadUrl",
"starops:CreateChat",
"starops:CreateThread",
"starops:GetThread",
"starops:GetThreadData",
"starops:ListThreads"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*",
"acs:starops:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetDigitalEmployeeSkill",
"starops:ListDigitalEmployeeSkills",
"starops:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetMission",
"starops:ListMissions",
"starops:ListTasks"
],
"Resource": [
"acs:starops:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetMcpService",
"starops:ListMcpServices",
"starops:FetchRemoteMcpTools"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetArtifact",
"starops:ListArtifacts"
],
"Resource": [
"acs:starops:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"starops:GetCreditQuota"
],
"Resource": [
"acs:starops:*:*:quota/credit"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetDigitalEmployee",
"cms:ListDigitalEmployees"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:CreateChat",
"cms:CreateThread",
"cms:GetThread",
"cms:GetThreadData",
"cms:ListThreads"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*",
"acs:cms:*:*:digitalemployee/*/thread/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetDigitalEmployeeSkill",
"cms:ListDigitalEmployeeSkills",
"cms:ListDigitalEmployeeSkillVersions"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/skill/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetMission",
"cms:ListMissions",
"cms:ListTasks"
],
"Resource": [
"acs:cms:*:*:mission/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetMcpService",
"cms:ListMcpServices",
"cms:FetchRemoteMcpTools"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/mcpservice/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetArtifact",
"cms:ListArtifacts"
],
"Resource": [
"acs:cms:*:*:digitalemployee/*/artifact/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:ListWorkspaces",
"cms:GetWorkspace",
"cms:GetEntityStore",
"cms:GetEntityStoreData"
],
"Resource": [
"acs:cms:*:*:workspace/*",
"acs:cms:*:*:entitystore/*",
"acs:cms:*:*:entitystoredata/*"
]
},
{
"Effect": "Allow",
"Action": [
"cms:GetCloudResourceData"
],
"Resource": [
"acs:cms:*:*:cloudresource"
]
},
{
"Action": [
"log:Get*",
"log:List*",
"log:Query*"
],
"Resource": "acs:log:*:*:*",
"Effect": "Allow"
},
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
"Condition": {
"StringEquals": {
"acs:Service": [
"operation-platform.aliyuncs.com",
"cloudmonitor.aliyuncs.com"
]
}
}
}
]
}
PassRole 授權路徑
授予 ram:PassRole 時，先確認數字員工綁定的 RoleArn，再把該 RoleArn 寫入 RAM 自訂權限原則。
在 STAROps 建立或編輯數字員工，確認數字員工綁定的 RAM Role。
如果選擇服務角色 ServiceRoleForCloudMonitor，Resource 使用
acs:ram::*:role/aliyunserviceroleforcloudmonitor。如果選擇自訂 RAM Role，Resource 使用該角色的 RoleArn，例如
acs:ram::*:role/starops-production-sre。
在 RAM 控制台建立自訂權限原則，並將策略授權給需要使用該數字員工的 RAM 使用者或使用者組。
服務角色 ServiceRoleForCloudMonitor 的 PassRole 樣本：
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": "ram:PassRole",
"Resource": "acs:ram::*:role/aliyunserviceroleforcloudmonitor",
"Condition": {
"StringEquals": {
"acs:Service": [
"operation-platform.aliyuncs.com",
"cloudmonitor.aliyuncs.com"
]
}
}
}
]
}如果使用自訂 RAM Role，請將以上 Resource 替換為該自訂角色的 RoleArn。
數字員工存取權限（RAM 角色許可權）
數字員工存取權限配置給 RAM Role，決定數字員工運行時能訪問哪些資料、雲資源和工具能力。這一層不是配置給 RAM 使用者的許可權。
系統內建員工不配置客戶側 RAM Role，運行時通常繼承當前 RAM 使用者權限。自訂數字員工必須綁定 RAM Role，RoleArn 就是該數字員工運行時訪問雲資源的身份。
使用服務角色快速配置
建立自訂數字員工時，RAM 角色類型可以選擇"服務角色"。如果選擇 ServiceRoleForCloudMonitor，數字員工會使用對應 RAM 角色 AliyunServiceRoleForCloudMonitor 訪問資料。該角色的 RoleArn 通常為：
acs:ram::<account-id>:role/aliyunserviceroleforcloudmonitor該服務角色適合查詢CloudMonitor 2.0、SLS 日誌、ARMS 應用監控等診斷資料，常用於唯讀巡檢、警示分析和報告產生。使用服務角色時，通常不需要手動設定角色信任策略和資料讀取權限原則，但仍需要給使用者授予數字員工操作許可權和對該服務角色的 ram:PassRole 許可權。
該服務角色不包含修改雲產品配置、變更資源狀態等許可權。如果數字員工需要執行雲產品更新、資源變更或其他寫操作，請改用自訂 RAM Role，並按最小許可權原則配置對應雲產品許可權。
使用自訂 RAM Role
如果選擇自訂 RAM Role，需要分別配置信任策略和權限原則。信任策略聲明哪些阿里雲服務可以扮演該角色；權限原則決定角色被扮演後可以訪問哪些資料和資源。
配置信任策略
如果選擇服務角色 ServiceRoleForCloudMonitor，通常不需要手動設定該信任策略。如果選擇自訂角色，請配置以下信任策略。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Principal": {
"Service": [
"operation-platform.aliyuncs.com",
"cloudmonitor.aliyuncs.com"
]
}
}
]
}配置資料存取權限
如果選擇服務角色 ServiceRoleForCloudMonitor，該角色已包含CloudMonitor 2.0 情境的資料讀取許可權。如果選擇自訂角色，可複製以下策略作為唯讀資料訪問起點。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": [
"log:Get*",
"log:List*"
],
"Resource": "acs:log:*:*:*"
},
{
"Effect": "Allow",
"Action": [
"cms:Get*",
"cms:List*"
],
"Resource": [
"acs:cms:*:*:workspace/*",
"acs:cms:*:*:cloudresource"
]
}
]
}全量許可權（開發測試環境）
以下策略僅用於開發測試環境快速驗證。生產環境請改為按資料來源、Workspace、記錄項目和雲產品資源範圍精細化授權。對會產生資源變更的工具調用，建議配合人工確認、審計和復原機制。
{
"Version": "1",
"Statement": [
{
"Effect": "Allow",
"Action": "cms:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "arms:*",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "sls:*",
"Resource": "*"
}
]
}許可權驗證
完成配置後，建議按以下順序驗證：
使用 RAM 使用者登入 STAROps。
開啟數字員工列表，確認能看到目標數字員工。
如果是自訂數字員工，確認頁面已綁定正確 RoleArn。
發起一個唯讀查詢會話，例如查詢指定 Workspace 或日誌。
如果會話失敗，先檢查 RAM Role 的權限原則和信任策略。
如果建立或更新數字員工失敗，檢查 RAM 使用者是否具備數字員工操作許可權和
ram:PassRole。使用 RAM 使用者在對應控制台開啟未經處理資料，確認是否具備人工核驗許可權。
常見問題
RAM 使用者能建立數字員工，但儲存 RoleArn 時報許可權不足
通常是缺少目標 RAM Role 的 ram:PassRole 許可權，或 PassRole 的 Resource 沒有覆蓋該 RoleArn。請為該 RAM 使用者授予目標 Role 的 ram:PassRole，並通過 acs:Service 限定 STAROps 相關服務。
數字員工會話提示資料許可權不足
請檢查數字員工綁定的 RAM Role，而不是只檢查 RAM 使用者權限。自訂數字員工運行時訪問資料使用 RAM Role 身份，RAM Role 必須具備目標 SLS、CMS、ARMS 或雲資源許可權。
RAM Role 有資料許可權，但使用者控制台看不到資料
RAM Role 許可權只授予數字員工運行時使用，不會自動授予 RAM 使用者。若使用者需要在控制台核驗資料，請為該 RAM 使用者單獨授予資料來源唯讀許可權。
選擇 ServiceRoleForCloudMonitor 後，為什麼不能執行更新操作
ServiceRoleForCloudMonitor 對應的 AliyunServiceRoleForCloudMonitor 面向CloudMonitor 2.0 資料讀取情境，適合查詢、診斷、巡檢和報告產生。它不包含雲產品配置更新、資源變更等許可權。需要執行更新操作時，請建立自訂角色並按需授予寫操作許可權。
RAM 使用者有資料來源許可權，但數字員工還是查不到資料
自訂數字員工不會自動繼承 RAM 使用者的資料許可權。請檢查數字員工綁定的 RAM Role 是否具備對應資料來源許可權。
唯讀使用者是否需要 PassRole
如果使用者只查看數字員工、會話、長期任務和報告，通常不需要 ram:PassRole。如果複製上文"唯讀許可權"模板，並且允許使用者基於自訂數字員工發起會話，則需要保留 ram:PassRole，同時把 Resource 收斂到服務角色或指定自訂角色的 RoleArn。
可以把 PassRole 的 Resource 設定為星號嗎
技術上可以，但不建議在生產環境長期使用。建議將 Resource 收斂到服務角色或 STAROps 專用自訂角色，並通過 acs:Service 限定只允許傳遞給 STAROps 相關服務。